up to 19.0 we were able to update our installations - obviously x86 installation. But 19.1 update is missing. And I have required = 0 although I have several 19.0 installations which ask their users to update.
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Show posts MenuMalware Name: Trojan:Script/Wacatac.H!ml
Number of infections: 1
Last detection time(UTC time): 3/23/2023 8:39:52 AM
These are the infections of this malware:
1. Computer name: XXX
Domain: XXX
Detection time(UTC time): 3/23/2023 8:39:52 AM
Malware file path: file:_C:\Windows\Temp\DockerDesktop\qkrpy3zo0cw
Remediation action: Remove
Action status: Succeeded
QuoteKenSharp — heute um 12:45 Uhr
You know, actually that's not my problem. I don't give a ....
========================================================================================= ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Starting ScriptRunner (V2.1.12.0) with 5 argument(s) ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Current culture info name is: de-DE ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Running as NT-AUTORIT..T\SYSTEM (Admin) ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Working directory: C:\WINDOWS\SoftwareDistribution\Download\Install ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
System path is C:\WINDOWS\System32 ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Argument #1 is: /MainFile=gs10010w64.exe Arguments 23.03.2023 12:52:45 1 (0x0001)
Inspects argument: mainfile=gs10010w64.exe Arguments 23.03.2023 12:52:45 1 (0x0001)
MainFile is: gs10010w64.exe Arguments 23.03.2023 12:52:45 1 (0x0001)
Argument #2 is: /MainArg=/S /v/qn Arguments 23.03.2023 12:52:45 1 (0x0001)
Inspects argument: mainarg=/s /v/qn Arguments 23.03.2023 12:52:45 1 (0x0001)
MainArg is: /S /v/qn Arguments 23.03.2023 12:52:45 1 (0x0001)
Argument #3 is: /norestart Arguments 23.03.2023 12:52:45 1 (0x0001)
Inspects argument: norestart Arguments 23.03.2023 12:52:45 1 (0x0001)
Unknown argument: norestart. 'norestart' doesn't match any known argument. Arguments 23.03.2023 12:52:45 1 (0x0001)
Argument #4 is: /RecommendedPreScriptPath=PatchMyPC-Remove-GPLGhostScript.ps1 Arguments 23.03.2023 12:52:45 1 (0x0001)
Inspects argument: recommendedprescriptpath=patchmypc-remove-gplghostscript.ps1 Arguments 23.03.2023 12:52:45 1 (0x0001)
RecommendedPrescriptPath is: PatchMyPC-Remove-GPLGhostScript.ps1 Arguments 23.03.2023 12:52:45 1 (0x0001)
Argument #5 is: /RecommendedPreScriptAbortOnFail Arguments 23.03.2023 12:52:45 1 (0x0001)
Inspects argument: recommendedprescriptabortonfail Arguments 23.03.2023 12:52:45 1 (0x0001)
RecommendedPrescriptAbortOnFail is: True Arguments 23.03.2023 12:52:45 1 (0x0001)
Update installation mode requested. ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Looking if update installation process need to be aborted due to running process ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
No need to abort due to the running processes ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Running script PatchMyPC-Remove-GPLGhostScript.ps1 ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Running PowerShell Script. ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Running C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -file "PatchMyPC-Remove-GPLGhostScript.ps1" ScriptRunner 23.03.2023 12:52:45 1 (0x0001)
Exiting With code: 0 ScriptRunner 23.03.2023 12:52:48 1 (0x0001)
Running update file: gs10010w64.exe with arguments: /S /v/qn PerfTimerLogger 23.03.2023 12:52:48 1 (0x0001)
Aborted due to timeout. ScriptRunner 23.03.2023 13:22:49 1 (0x0001)
Running update file: gs10010w64.exe with arguments: /S /v/qn finished with Elapsed Time: 30 minutes 01 seconds 127 milliseconds PerfTimerLogger 23.03.2023 13:22:49 1 (0x0001)
An error occurred: Der Prozess muss vor dem Bestimmen der angeforderten Informationen beendet werden.
Void EnsureState(State) ScriptRunner 23.03.2023 13:22:49 1 (0x0001)
End of Script Runner. Exit code is: -2146233079 ScriptRunner 23.03.2023 13:22:49 1 (0x0001)
if ((Get-ChildItem -path $env:localappdata\Pathto\Citrix\Receiver.exe -ErrorAction SilentlyContinue).exists) {Write-Host "True"}
Application2 superseding Application1 also running as user and creates a dummy file where user can write to (like c:\temp\citrix.tmp)if ((Get-ChildItem -path c:\temp\citrix.tmp -ErrorAction SilentlyContinue).exists) {Write-Host "True"}
Application3 deployed as system with detection c:\temp\citrix.tmp does not exist if (!(Get-ChildItem -path c:\temp\citrix.tmp -ErrorAction SilentlyContinue).exists) {Write-Host "True"}
and running Cleanuptool and deleting citrix.tmp file<lar:And>
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_OEMComputerSystem WHERE SystemTypeID = '2230' OR SystemTypeID = '2231' OR SystemTypeID = '2232' OR SystemTypeID = '2233' OR SystemTypeID = '2234' OR SystemTypeID = '2235' OR SystemTypeID = '2272' OR SystemTypeID = '2273' OR SystemTypeID = '2274' OR SystemTypeID = '2281' OR SystemTypeID = '2328' OR SystemTypeID = '2329' OR SystemTypeID = '2330' OR SystemTypeID = '2331' OR SystemTypeID = '2332' OR SystemTypeID = '2342' OR SystemTypeID = '2343' OR SystemTypeID = '2344' OR SystemTypeID = '2345' OR SystemTypeID = '2350' OR SystemTypeID = '2351' OR SystemTypeID = '2352' OR SystemTypeID = '2353' OR SystemTypeID = '2354' OR SystemTypeID = '2355' OR SystemTypeID = '2356' OR SystemTypeID = '2357' OR SystemTypeID = '2358' OR SystemTypeID = '2359' OR SystemTypeID = '2360' OR SystemTypeID = '2361' OR SystemTypeID = '2365' OR SystemTypeID = '2370' OR SystemTypeID = '2371' OR SystemTypeID = '2379' OR SystemTypeID = '2381' OR SystemTypeID = '2431' OR SystemTypeID = '2432' OR SystemTypeID = '2435' OR SystemTypeID = '2436' OR SystemTypeID = '2437' OR SystemTypeID = '2438' OR SystemTypeID = '2439' OR SystemTypeID = '2440' OR SystemTypeID = '2441' OR SystemTypeID = '2442' OR SystemTypeID = '2443' OR SystemTypeID = '2444' OR SystemTypeID = '2462' OR SystemTypeID = '2463' OR SystemTypeID = '2464' OR SystemTypeID = '2465' OR SystemTypeID = '2466' OR SystemTypeID = '2468' OR SystemTypeID = '2469' OR SystemTypeID = '2470' OR SystemTypeID = '2471' OR SystemTypeID = '2472' OR SystemTypeID = '2473' OR SystemTypeID = '2474' OR SystemTypeID = '2475' OR SystemTypeID = '2490' OR SystemTypeID = '2491' OR SystemTypeID = '2493' OR SystemTypeID = '2494' OR SystemTypeID = '2496' OR SystemTypeID = '2497' OR SystemTypeID = '2498' OR SystemTypeID = '2499' OR SystemTypeID = '2500' OR SystemTypeID = '2502' OR SystemTypeID = '2505' OR SystemTypeID = '2508' OR SystemTypeID = '2509' OR SystemTypeID = '2550' OR SystemTypeID = '2591' OR SystemTypeID = '2592' OR SystemTypeID = '2593' OR SystemTypeID = '2594' OR SystemTypeID = '2606' OR SystemTypeID = '2607' OR SystemTypeID = '2608' OR SystemTypeID = '2609' OR SystemTypeID = '2610' OR SystemTypeID = '2611' OR SystemTypeID = '2612' OR SystemTypeID = '2613' OR SystemTypeID = '2614' OR SystemTypeID = '2615' OR SystemTypeID = '2616' OR SystemTypeID = '2622' OR SystemTypeID = '2623' OR SystemTypeID = '2624' OR SystemTypeID = '2625' OR SystemTypeID = '2626' OR SystemTypeID = '2629' OR SystemTypeID = '2630' OR SystemTypeID = '2631' OR SystemTypeID = '2632' OR SystemTypeID = '2633' OR SystemTypeID = '2642' OR SystemTypeID = '2643' OR SystemTypeID = '2644' OR SystemTypeID = '2645' OR SystemTypeID = '2646' OR SystemTypeID = '2647' OR SystemTypeID = '2651' OR SystemTypeID = '2662' OR SystemTypeID = '2663' OR SystemTypeID = '2664' OR SystemTypeID = '2665' OR SystemTypeID = '2666' OR SystemTypeID = '2717' OR SystemTypeID = '2718' OR SystemTypeID = '2753' OR SystemTypeID = '2754' OR SystemTypeID = '2755' OR SystemTypeID = '2756' OR SystemTypeID = '2757' OR SystemTypeID = '2758' OR SystemTypeID = '2759' OR SystemTypeID = '2760' OR SystemTypeID = '2761' OR SystemTypeID = '2762' OR SystemTypeID = '2763' OR SystemTypeID = '2764' OR SystemTypeID = '2818' OR SystemTypeID = '2819' OR SystemTypeID = '2820' OR SystemTypeID = '2821' OR SystemTypeID = '2822' OR SystemTypeID = '2823' OR SystemTypeID = '2824' OR SystemTypeID = '2825' OR SystemTypeID = '2826' OR SystemTypeID = '2827' OR SystemTypeID = '2828' OR SystemTypeID = '2829' OR SystemTypeID = '2830' OR SystemTypeID = '2831' OR SystemTypeID = '2832' OR SystemTypeID = '2833' OR SystemTypeID = '2834' OR SystemTypeID = '2837' OR SystemTypeID = '2838' OR SystemTypeID = '2839' OR SystemTypeID = '2840' OR SystemTypeID = '2857' OR SystemTypeID = '2858' OR SystemTypeID = '2859' OR SystemTypeID = '2954' OR SystemTypeID = '2955' OR SystemTypeID = '2956' OR SystemTypeID = '3009'" />
<lar:Or>
<lar:And>
<bar:WindowsVersion Comparison="EqualTo" MajorVersion="10" MinorVersion="0" ServicePackMajor="0" ServicePackMinor="0" />
<bar:Processor Architecture="9" />
</lar:And>
</lar:Or>
<lar:Or>
<lar:And>
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE OSBuildNumber >= '0'" />
<lar:And>
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE OSBuildNumber >= '0'" />
<lar:Or>
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0AA7_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0AA7_~') AND VersionString >='0020.0100.0010.0007'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0A2B&REV_0010_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0A2B&REV_0010_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0029&REV_0000_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0029&REV_0000_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0029&REV_0001_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0029&REV_0001_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0AAA&REV_0000_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0AAA&REV_0000_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0AAA&REV_0001_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0AAA&REV_0001_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0AAA&REV_0002_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0AAA&REV_0002_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0025&REV_0001_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0025&REV_0001_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0025&REV_0002_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0025&REV_0002_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0A2B&REV_0001_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0A2B&REV_0001_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0026&REV_0000_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0026&REV_0000_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0026&REV_0001_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0026&REV_0001_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0026&REV_0002_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0026&REV_0002_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0032&REV_0000_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0032&REV_0000_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0032&REV_0001_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0032&REV_0001_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0033&REV_0000_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0033&REV_0000_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0033&REV_0001_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0033&REV_0001_~') AND VersionString >='0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_USB\VID_8087&PID_0A2A_' AND Description < 'Dell:DRVR_USB\VID_8087&PID_0A2A_~') AND VersionString >='0020.0100.0010.0007'" />
</lar:Or>
</lar:And>
</lar:And>
<lar:Or>
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_103306__' AND Description < 'Dell:DRVR_103306__~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0026_' AND Description < 'Dell:DRVR_8087_0026_~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0029_' AND Description < 'Dell:DRVR_8087_0029_~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0A2B_' AND Description < 'Dell:DRVR_8087_0A2B_~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0025_' AND Description < 'Dell:DRVR_8087_0025_~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0A2A_' AND Description < 'Dell:DRVR_8087_0A2A_~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0AAA_' AND Description < 'Dell:DRVR_8087_0AAA_~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0032_' AND Description < 'Dell:DRVR_8087_0032_~') AND VersionString >= '0022.0130.0000.0002'" />
<bar:WmiQuery Namespace="Root\Dell\sysinv" WqlQuery="SELECT * FROM Dell_SoftwareIdentity WHERE (Description >= 'Dell:DRVR_8087_0033_' AND Description < 'Dell:DRVR_8087_0033_~') AND VersionString >= '0022.0130.0000.0002'" />
</lar:Or>
</lar:Or>
</lar:And>
(Get-WmiObject -Namespace "Root\Dell\sysinv" -query "SELECT description FROM Dell_SoftwareIdentity WHERE Description like 'Dell:DRVR_%'").Description
look for matching IDs and go on and on. But maybe you had the same issues and actually found an easier solution.
PS C:\> Invoke-WebRequest -UseBasicParsing https://www.tableau.com
Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.
At line:1 char:1
+ Invoke-WebRequest -UseBasicParsing https://www.tableau.com
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
PS C:\>
QuoteSo, if a per-user install of the product is performed the installation using the SYSTEM-wide install won't work?
Settings have changed. Reloading... Worker 01.10.2019 17:37:05 44 (0x002C)
Next scheduled run time: 02.10.2019 04:00:00 Worker 01.10.2019 17:37:08 6 (0x0006)
Applying filter: Vendor LIKE '%' AND (Title LIKE '%' OR UpdateID LIKE '%') AND Declined LIKE '%' AND Expired LIKE '%' AND MetaData LIKE '%' FrmUpdatesModificationWizard 01.10.2019 17:39:57 1 (0x0001)